A bill introduced to amend the California Consumer Privacy Act of 2018 (“CCPA” or the “Act”) could greatly expand the risks to businesses that collect the personal information of California consumers. Senate Bill 561 (“SB 561”) would expand the CCPA’s private right of action to any violation of a consumer’s CCPA rights, remove the existing 30-day cure period, and eliminate businesses’ right to consult the AG’s office regarding compliance. SB 561 would not impact the CCPA’s current effective date of January 1, 2020.
On Friday night, February 22, Senator Hannah-Beth Jackson (D-19th Dist.) introduced SB 561 to the California State Senate and appeared alongside California Attorney General Xavier Becerra the following Monday afternoon to promote the amendment, stating that SB 561 seeks to address several “impediments” to the implementation of the CCPA and to “provide the Attorney General’s office with the tools they requested to ensure effective enforcement” of the Act.
SB 561 leaves the CCPA’s substantive requirements unchanged and instead modifies the Act’s enforcement provisions such that the risk landscape for businesses processing the personal information of California consumers will be dramatically altered. As currently drafted, SB 561:
- Expands the private right of action to any consumer whose “rights under [the CCPA] are violated,” which is currently limited to suits where consumers’ nonencrypted or nonredacted personal information has been subject to a data breach as a result of a business’ violation of its duty to implement and maintain reasonable security procedures, and maintains the existing statutory damages structure;
- Removes entirely the 30-day cure period that currently requires a consumer to provide written notice to a business of an alleged violation before filing suit and prohibits the consumer’s suit if the alleged violation is cured within 30 days; and
- Replaces the Attorney General’s obligation to provide compliance “opinions” to businesses and third parties with a grant of authority to the AG such that the AG can “publish materials that provide businesses and others with general guidance on how to comply” with the CCPA.
The private right of action takes effect concurrently with the CCPA on January 1, 2020. If SB 561 is passed as drafted, consumers may file suit for any alleged violation of their CCPA rights, without any demonstration of harm and even if the Attorney General has not yet released implementing regulations or provided additional guidance on how the CCPA should be interpreted by businesses. Consider, for example, the “anti-discrimination” and financial incentives provision: As we’ve previously discussed, this provision is ambiguous and references a conceptually confusing standard—the “value provided to the consumer by the consumer’s data.” If SB 561 passes unamended, businesses may be forced to defend their decisions in court before the AG even articulates what the law requires.
SB 561 signals that while the CCPA is continuing to evolve, companies cannot be complacent in their efforts to comply with the law by January 1, 2020.
For additional analyses of the California Consumer Privacy Act and the challenges ahead for companies, read Hogan Lovells’ CCPA blog series or attend our CCPAnow discussions on March 12 and 13, 2019.
*Filippo Raso was not yet a member of the Washington, D.C. bar when this post was originally published.